frontend-playbook

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to run various shell commands for project initialization (npx create-eth), environment management (yarn fork), and deployment (yarn build, yarn bgipfs). These are standard operations for Ethereum frontend development.
  • [EXTERNAL_DOWNLOADS]: Utilizes npx to fetch and run the latest create-eth utility from the npm registry and uses curl to interact with Vercel and Ethereum RPC APIs. These represent interactions with well-known technology services and official registries.
  • [DYNAMIC_EXECUTION]: Implements a build-time injection using NODE_OPTIONS="--require ..." to load a local localStorage polyfill. This is a standard technical workaround for static site generation issues in Node.js 25+ environments.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a production pipeline where the agent is expected to process user-provided values (such as project names and ENS subdomains) and insert them into shell commands.
  • Ingestion points: Placeholders in SKILL.md for project variables and interactive user input.
  • Boundary markers: Absent in the instructional text.
  • Capability inventory: File system manipulation (rm -rf), package execution (npx), and network interactions (curl).
  • Sanitization: Not explicitly documented in the provided instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 02:26 AM